CVE-2026-45632

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.26.8

Description Dokploy is a self-hostable Platform as a Service (PaaS) where the schedule router fails to enforce organization or role checks. This allows any authenticated user to create, update, run, or delete schedules belonging to other organizations by providing the scheduleId or serverId. Because schedule types server and dokploy-server write and execute scripts on the host or remote servers, this can lead to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on a target machine.

Recommendations Update to a version later than 0.26.7.